|
Joe,
Look into ASP/ASPX scripting that will allow you to set
passwords from a page on an IIS server. I recommend checking for and
preventing any user that is in a group that has higher-than-normal access rights
in your NT/AD domain from changing their password over the web-page. If
you use a web-page to do this you really MUST be running SSL on the web server
to prevent NT/AD passwords being sent in plain-text.
Even if you decided to use a different authentication method
for IMail (IMail DB or external SQL DB), with an IMail -> NT/AD sync tool,
you would still want to ensure only SSL access from the internet since POP,
IMAP, SMTP auth, and HTTP will all send passwords in plain-text (unless using
SSL). This prevents email users from inadvertently giving away their NT/AD
passwords over the internet. If you are unable to implement SSL, you
should consider an alternative to having password synchronization, like keeping
one set of passwords for NT and another for email (making sure they're not the
same).
-ives
----- Original Message -----
Sent: Wednesday, June 18, 2003 12:50
AM
Subject: Re: [IMail Forum] Change
Password Feature
Joe,
By sync, do you mean the
ability to set an NT/AD password using the IMail password
service?
--> yes.
Yes... generally not a good idea for
this to have been allowed in the first place. Your entire NT/AD
security hinged on the security of IMail. You could still have
IMail use NT/AD for authentication (not external DB), but users would
change their PW as they would normally through the standard password
changing interface for their windows client (9x,XP,2k,etc.).
--> i understand the security risks involved. in this
instance i am the messenger .. not the implementer .. we have a scenario where
not all users have the ability to change their password from a client as we
offer distance education services. and it's more of a political thing
:o)
If you need people
to be able to change a password from a web-page, I would look into
3rd-party products that provide PW setting services from the web or even
write your own with .NET - very easy to do if the service is running on
IIS with NT user auth (really should be using SSL here too). Then
simply add a link to it on your IMail HTTP template pages. This would
allow users to change their NT/AD password from the web.
If IMail to NT/AD auth is a
performance issue, consider using a different auth mechanism combined
with a 3rd party tool for password sync from Web / SQL to AD (start by
calling Microsoft and ask for an MS solutions channel partner that can
direct you to the correct products / vendors).
--> performance isn't the issue, just the functionality we are using
now of synching the NT/AD password using IMail password service.
thx
-ives
----- Original Message -----
From: Joe
Velardi
To:
[EMAIL PROTECTED]
Sent: Tuesday, June 17, 2003 8:58
PM
Subject: [IMail Forum] Change Password
Feature
hi,
i have already discussed the 'Change
Password' feature previously.
http://www.mail-archive.com/[EMAIL PROTECTED]/msg66798.html
our current version (v6.05)
allows password synch with our current NT4 infrastructure.
with our move towards W2003, we decided to
look into IMail v8 but security restrictions
in
this version do not allow password synch with active
directory.
i was
wondering if there is another method that would allow user to synch
their passwords with AD ?
IMail has a feature that allows you to use an external database.
can this point to the AD database ?
many thx.
|
